Introduction
The German state and its European partners have built, and are continuing to build, a comprehensive system for monitoring, attributing, and controlling online activity. This paper describes the likely technical capabilities of that system: the technologies deployed or under development, the legal authorities that operate them, and the aggregate capability they produce when considered together.
The account that follows is inferential. It draws on publicly available sources – legislation and draft legislation, government-funded research programs, procurement records, published technical standards, news reporting, and the known capabilities of commercially available surveillance and analytics tools – to construct a picture of what the system can plausibly do. No single source is sufficient; the picture emerges from the combination. Where the paper describes a capability, it means that the technical infrastructure exists or is being built, that the legal authority to use it exists or is being sought, and that the operational use is consistent with what is publicly known. It does not mean that the capability has been confirmed in every detail by official disclosure.
This paper does not treat legal constraints on the use of these technologies as meaningful limitations on the system’s capabilities. German law contains broad exemptions for intelligence and law-enforcement use of techniques that would be criminal offenses if employed by private actors, and the history of the relevant statutes – successive versions struck down by courts and reinstated in modified form – suggests that legal boundaries in this area are negotiable in practice. The question of what the state is permitted to do is distinct from the question of what it is able to do; this paper addresses the latter.
The paper also does not address extrajudicial enforcement, the use of artificial intelligence in surveillance or automated decision-making, or the circumvention technologies and emerging alternatives that may render parts of this infrastructure ineffective. Each of these is treated in subsequent papers. The objective here is not to draw a precise boundary between what is and is not possible, but to provide a broad overview of the system’s likely shape.
The system’s reach, taken as a whole, is broad:
- Communications. Bulk interception, metadata retention, and device compromise.
- Identity. IP-to-subscriber resolution and mandatory identity binding.
- Location. Cellular, Wi-Fi, CCTV, license-plate recognition, and radio-frequency monitoring.
- Content. Platform takedowns, ISP filtering, DNS blocking, and search-engine deindexing.
- Finance. Transaction surveillance and account-level controls under PSD2, MiCA, and anti-money-laundering regulations.
- Reach. Cross-border data sharing and extraterritorial enforcement under EU instruments.
The same collection, attribution, and control capabilities serve all categories of state objective indifferently. A tool built to find drug traffickers can, without any technical modification, also find dissidents; a database assembled to catch tax cheats can, without any technical modification, also catalogue political affiliation. The architecture is not partitioned by purpose.
Collection and Interception
The first and most familiar layer of the architecture consists of passive and compulsory data gathering: collection of communications in flight and retention of metadata at rest.
Bulk Communications Interception
Bulk communications interception in Germany is primarily the responsibility of the Bundesnachrichtendienst (BND), the federal foreign intelligence service, operating under the statutory framework of the Artikel 10-Gesetz. Collection points include major Internet exchange points such as DE-CIX in Frankfurt, long-haul transit links, and the European landing sites of international undersea cables. The technical operation at these sites involves selector-based filtering: the full traffic stream is inspected against lists of identifiers at line rate, matching flows are retained and processed, and the remainder is discarded. The scale of the operation, the selectors in use, and the retention periods are classified.
Bulk Metadata Retention
Bulk metadata retention is conceptually distinct from interception. Under a retention framework usually referred to as Vorratsdatenspeicherung, telecommunications providers and Internet service providers are required to retain traffic and location metadata – subscriber identity, call records, IP assignment logs, cell-tower associations, and similar – for a statutory period, during which law enforcement authorities may request access. The German implementation has had a contested legal history: successive versions of the statute have been struck down by the Federal Constitutional Court and by the Court of Justice of the European Union, and successive versions have been reinstated in modified form. The underlying capability, and the political and regulatory pressure to maintain it, have persisted across all of these rounds.
Attribution and Identity
The collection layer gathers data. The attribution and identity layer ties that data to specific natural persons. For most purposes of everyday enforcement, attribution is the binding constraint, because raw intercepted traffic or retained metadata is of little use to a prosecutor until it can be tied to a named defendant.
IP-to-Subscriber Resolution
The workhorse mechanism by which an IP address or an online identifier is resolved to a named subscriber is known as Bestandsdatenauskunft. The relevant provisions in the German Code of Criminal Procedure and in the Telecommunications Act authorize prosecutors to require Internet service providers to disclose subscriber information associated with a given network address. This is the routine technical link between an online act – a post, a message, a file transfer – and a named individual, and it is the mechanism through which the great majority of prosecutions involving online speech or conduct are initiated. It is also the mechanism that makes Vorratsdatenspeicherung operationally useful, by connecting stored metadata to identifiable persons on demand.
Physical Attribution
Physical attribution refers to the set of capabilities by which the physical location, movement, or identity of a person or device is determined by means other than network-level data. This includes:
- Radio-frequency monitoring and time-of-flight geolocation of transmitters, which can localize a transmitting device at the physical layer regardless of any MAC-address or IMSI rotation performed at higher layers.
- IMSI catchers, which operate as rogue base stations to capture cellular identifiers and, in some configurations, downgrade encryption.
- CCTV and automated license plate recognition, both in urban and highway deployments, feeding into databases operated by the Bundeskriminalamt (BKA) and state-level police authorities.
- War-driving and radio-frequency fingerprinting databases, both commercial (of the WiGLE type) and state-collected, which record the observed locations of Wi-Fi access points and Bluetooth devices.
The practical significance of physical attribution lies in cross-layer correlation: combining network-level, cellular, radio-frequency, and video data makes it possible to defeat single-layer evasion techniques that would be effective against any one of them in isolation.
Identity Binding
Identity binding refers to the structural enrolment of individuals into systems that link their online activity to a verified legal identity. This happens at two distinct layers.
At the operating-system and wallet layer, the German Personalausweis mit Online-Ausweisfunktion (the electronic function of the national identity card) and the European Digital Identity Wallet being rolled out under eIDAS 2 are the principal instruments: each provides a cryptographically verified identity that can be presented to online services.
At the platform layer, real-name requirements (Klarnamenpflicht in the German discussion) and age-verification mandates under the German Jugendmedienschutz-Staatsvertrag (JMStV) and emerging EU-level age-verification regulations serve a similar binding function, though through commercial intermediaries rather than through state-issued credentials. Both layers have legitimate purposes: fraud prevention, consumer protection, authentication of commercial transactions, and protection of minors. Both layers also, as a matter of the technology they deploy, reduce the set of practical anonymity mechanisms available to ordinary users.
Software Attestation
Software attestation is a fourth attribution-layer component. The EU Cyber Resilience Act (CRA), the NIS2 Directive, and a set of sector-specific rules establish requirements on the security posture of products with digital elements sold in the European market. The CRA does not, in its text, directly mandate code signing of all software. What the combination of the CRA, NIS2, and adjacent platform-level measures – Google Play Developer Verification, Apple notarization, the attestation framework associated with the eIDAS 2 wallet, and the emerging certification and conformity regime operated by the Bundesamt für Sicherheit in der Informationstechnik (BSI) – is creating is the technical and regulatory infrastructure within which the mandatory signing of all software running on mass-market devices becomes feasible as a future step. Whether that step is ever taken is a political question; the infrastructure on which it would rest is being built now.
Device Compromise
The capabilities in this section employ techniques that, when used by private actors, are prosecuted as serious criminal offenses under German law (specifically under the computer-crime provisions of the Strafgesetzbuch on unauthorized access to and interception of data). Their use by the state rests on statutory authorization rather than on any technical distinction from the private-actor versions.
The Bundestrojaner
The German state operates a capability, commonly referred to in the press as the Bundestrojaner, for the covert installation of software on target devices. The legal framework distinguishes two variants: Quellen-Telekommunikationsuberwachung (Quellen-TKU), which targets ongoing communications by reading them on the endpoint before encryption is applied, and Online-Durchsuchung, which performs broader searches of stored data on a compromised device. Technically, both variants rely on the exploitation of software vulnerabilities, sometimes undisclosed (“zero-day”) ones, to gain access to hardware that the user controls. The technique is indistinguishable from criminal intrusion in method and, in many cases, in the specific exploits used; the distinguishing feature is a warrant.
Client-Side Scanning
Client-side scanning follows the same logic: software installed on the user’s device, inspecting the user’s data, without the user’s consent. The European Chat Control proposal – formally the Child Sexual Abuse Regulation (CSAR) – would require providers of end-to-end encrypted messaging services to scan message content on the user’s device before encryption, against databases of prohibited material. The EU Going Dark High-Level Expert Group has recommended a broader set of lawful-access requirements applicable to device manufacturers, platforms, and encrypted-communication providers. Germany’s position on these proposals has been mixed: federal agencies have supported them in some forms, while the German government has at times acted as a brake during Council negotiations. The technical character of client-side scanning, if mandated, is that of software running on the user’s device inspecting the user’s content without the user’s consent – software whose behavior is indistinguishable from that of commercial spyware, differing only in who authorizes it.
Certificate Authority Abuse
The TLS ecosystem depends on a set of certificate authorities whose signatures are trusted by browsers and operating systems. A state that can compel a certificate authority within its jurisdiction to issue a certificate on demand, or that can cause such a certificate to be accepted by default by the browsers its citizens use, obtains the ability to perform man-in-the-middle attacks on otherwise-encrypted communications. The eIDAS 2 framework includes provisions on Qualified Website Authentication Certificates (QWACs) that have been the subject of extended public controversy on precisely these grounds, with browser vendors and civil-liberties organizations arguing that the provisions create exactly this form of state leverage. The final eIDAS 2 text was amended under browser-vendor pressure to soften these provisions, but the amendments narrowed rather than eliminated the risk. Combined with the software-attestation infrastructure described above, control over both certificate issuance and attestation enables a government to, in principle, read any encrypted communication entering or leaving devices under its jurisdiction.
Content Control and Suppression
Where the preceding sections are about access to data, this section is about shaping what users can read, reach, or publish in the first place. The capabilities described here are not typically covert: they operate through published rules, transparent blocking notices, and public takedown orders.
DNS Manipulation
DNS manipulation through the injection of false responses, as opposed to the honest return of block pages, allows an Internet service provider to silently redirect a user to a substitute destination without any visible indication that the original domain was blocked. Used as a content-control mechanism, this is a form of man-in-the-middle attack on the DNS protocol; used as a surveillance or traffic-diversion mechanism, it is the same technique state-sponsored adversaries in other jurisdictions have long been criticized for employing.
ISP-Level Filtering
ISP-level filtering is the broadest layer. Internet service providers receive blocking orders from courts, regulatory bodies, or – in a blurred category – informally coordinated government requests with which voluntary compliance has become routine. The filter lists and block-page responses are distributed through the ISP’s own infrastructure and, increasingly, through update mechanisms embedded in customer-premises equipment such as home routers supplied by the ISP. In the most advanced deployments, monitoring capabilities are also embedded in ISP-managed customer-premises equipment, which provides a vantage point inside the user’s local network without requiring any action by the user.
DNS Blocking
When a user’s browser requests a blocked domain, the ISP’s DNS server returns a response directing the browser to an informational page that tells the user the domain has been blocked. The user sees the block and knows it happened. Under DNS manipulation, described in the previous section, the ISP silently redirects the user with no indication that anything was intercepted. Both techniques use the same infrastructure – the ISP’s control over DNS responses – but one is visible and the other is covert.
Platform-Level Filtering
Platform-level filtering is conducted by the large content platforms themselves, in compliance with the German Netzwerkdurchsetzungsgesetz (NetzDG) and, subsequently, with the EU Digital Services Act (DSA). These instruments impose statutory response times on the removal of content flagged as illegal. In practice, the combination of short response windows and large takedown volumes means that the great majority of removals occur without case-by-case judicial review, though statutory internal-appeal mechanisms exist.
Platform-level filtering also includes the deindexing of content by search engines, which is suppression of a distinct character from outright deletion – the content remains available, but it becomes invisible to the default discovery mechanisms. And it includes mandatory reporting flows under which platforms transmit certain categories of flagged content directly to the BKA.
Hosting and Infrastructure Seizure
German law enforcement authorities can compel domestic hosting providers such as Hetzner, IONOS, and STRATO to produce data or remove content on the order of a prosecutor or a court, and can obtain the physical seizure of servers located on German territory in the course of a criminal investigation. Domain-level intervention is available through the cooperation of DENIC and other registrars, who can suspend or transfer domains on legal order. Where ISP-level filtering intervenes on traffic in flight and platform-level filtering operates on third-party-hosted content, hosting and infrastructure seizure reaches the storage layer itself and directly coerces the parties who control it.
Financial-Rail Controls
The financial layer matters because online activity that has an economic dimension – donations, subscriptions, the purchase of privacy tools, the operation of independent publications – runs through this layer and is therefore subject to whatever controls are applied to it.
The Revised Payment Services Directive (PSD2), its anticipated successor (PSD3 and the associated Payment Services Regulation), SEPA and the proposed digital euro, and the AML/KYC obligations imposed by the Markets in Crypto-Assets Regulation (MiCA) and the EU Anti-Money-Laundering Regulation together constitute a regulatory framework under which transaction histories, account balances, counterparty relationships, and payment metadata are accessible to regulators and, through them, to law-enforcement and administrative authorities. Account freezing and denial of payment services operate as a de facto enforcement mechanism against disfavored activity in cases where criminal prosecution would be slow or difficult.
Blockchain surveillance extends this framework to cryptocurrency. The BKA and the Frankfurt Zentralstelle zur Bekämpfung der Internetkriminalität (ZIT) use commercial analytics tools – principally TRM Labs and Chainalysis – for address clustering, entity attribution, and tracing fund flows across exchanges. The capability is operationally mature: the Kingdom Market darknet takedown (2023), Operation Final Exchange (2024, seizure of 47 no-KYC exchanges), and the Movie2k.to case (retrospective tracing of a decade-old Bitcoin trail to a seizure of nearly 50,000 BTC) all relied on on-chain analysis combined with exchange-subpoena workflows under Bestandsdatenauskunft. MiCA and the EU AMLR require crypto-asset service providers to monitor transactions and report suspicious activity to BaFin, which feeds into law enforcement referrals. The documented gap is privacy-preserving cryptocurrencies: Monero and Zcash flows have not been publicly traced in any German case, and cross-chain bridges and decentralized exchange protocols are not reliably attributable with current tools.
Cross-Border Data Sharing and Extraterritorial Reach
Europol and its Internet Referral Unit coordinate content-flagging activity across EU member states. The Schengen Information System (SIS II) provides shared databases of persons and objects of interest. The Prum framework establishes reciprocal access to biometric and vehicle-registration data among member states. The EU e-Evidence Regulation authorizes direct production and preservation orders against service providers in other member states, bypassing the traditional machinery of mutual legal assistance. The Digital Services Act grants EU regulators certain access and oversight powers that apply extraterritorially to service providers serving EU users, regardless of the provider’s place of establishment.
Taken together, these instruments mean that the German state’s access to content, metadata, and identity data is not limited by the German border: data held elsewhere in the European Union is reachable on broadly the same legal footing as data held domestically, and certain categories of data held outside the Union are reachable through extraterritorial provisions whose precise scope is the subject of continuing legal argument.
The BSI as Institutional Overlay
Several of the layers described above converge on a single federal institution. The Bundesamt für Sicherheit in der Informationstechnik (BSI) is the certification body for cryptographic products sold into regulated sectors, the technical authority for the implementation of the Cyber Resilience Act and NIS2 in Germany, the certifier of the eID card and the domestic contributor to the eIDAS 2 wallet framework, and the central coordinator for federal IT security. It is, in practice, the gatekeeper for what software and hardware can be sold and operated in regulated parts of the German economy.
The BSI is not statutorily independent in the sense a constitutional court is independent. It is a subordinate agency of the Federal Ministry of the Interior (BMI), which is also the parent ministry of the Bundeskriminalamt and the federal police. The same institutional nexus therefore certifies cryptographic products, approves attestation frameworks, sets the technical baseline for identity binding, and reports up to the ministry whose law-enforcement and internal-security arms benefit most directly from limits on those same protections. Certification, attestation, and identity infrastructure are administered by an institution whose reporting line is to the agency whose operational interests diverge from those of the citizens the certifications nominally protect.
Aggregate Capability
Considered as a single system, the capabilities described above enable the following against ordinary users who have not taken specific steps to evade them.
The content of most communications is reachable. Bulk interception at Internet exchange points, certificate-authority leverage against TLS, platform-side reporting and takedown mandates, device compromise under prosecutorial order, and – in the capabilities currently in development – mandatory client-side scanning together cover the principal pathways by which communication content becomes visible to state actors. Strong end-to-end encryption narrows this set substantially for motivated users, but the combination of endpoint compromise capabilities and the emerging client-side-scanning agenda is specifically directed at closing that gap.
Every online action under an ordinary subscription resolves to a named individual. The combination of IP-to-subscriber resolution under Bestandsdatenauskunft and bulk metadata retention under Vorratsdatenspeicherung means that an action taken now can be attributed within hours, and an action taken months ago can be attributed retrospectively as long as the retention window has not expired.
Location and movement are continuously reconstructible. Cellular, Wi-Fi, CCTV and automated license-plate recognition, and physical-layer radio-frequency monitoring together provide a cross-layer correlation capability that defeats MAC-address and IMSI rotation and most practical physical anonymization techniques available to ordinary users.
Financial transactions and relationships are visible. Under PSD2 and the regulatory framework that extends it, transaction histories, account balances, and counterparty relationships are accessible to regulators and through them to law-enforcement and administrative authorities. The MiCA and EU AMLR provisions extend the same visibility to crypto on- and off-ramps, and the proposed digital euro, if deployed as currently specified, would extend it to point-of-sale transactions now carried by cash.
The German state’s reach does not stop at the German border. Through the EU e-Evidence Regulation, SIS II, the Prum framework, Europol, and the Digital Services Act, content, metadata, and identity data held elsewhere in the European Union are accessible on broadly the same legal footing as data held domestically, and certain categories of data held outside the Union are reachable under extraterritorial provisions whose precise scope is the subject of continuing legal argument.
The aggregate is: against a citizen using commodity devices and default software, the German state has standing capacity to reconstruct communications, movements, relationships, and finances on demand. The population that can reliably evade the system is small, unrepresentative, and dependent on tools, threat models, and operational discipline that place its members outside the monitored default.
Conclusions
The surveillance architecture described above appears comprehensive. But the system as described is the system as designed – the system as the state would prefer it to operate. The question it leaves open is whether the system actually works against determined actors, and the answer, which subsequent papers in this series will address in detail, is that in important respects it does not.
A range of current and emerging technologies – end-to-end encryption, onion routing, mesh networking, software-defined radio, commodity microcontrollers operating outside the attestation framework, privacy-preserving cryptographic protocols, decentralized infrastructure, and the physical-layer alternatives that bypass the monitored network entirely – are sufficient to defeat every component of the architecture described here. A subsequent paper will examine the cost structure of this contest in detail, but the pattern suggested by the public record is that evasion costs are falling faster than surveillance costs are rising, and that new state capabilities are typically matched within a few years by commodity countermeasures.
The system’s structural costs, meanwhile, accumulate independently of whether it achieves any enforcement benefit. The infrastructure creates high-value targets for breach, generates a blackmail surface against anyone whose profile contains privacy-sensitive material, and corrodes the independence of the oversight institutions that are supposed to constrain it. These costs fall on the activities the state itself has an interest in protecting – banking, medical care, legal practice, corporate negotiation, journalism, emergency communication – and they scale with the comprehensiveness of the collection.
The thesis that subsequent papers will examine and defend is that the system’s primary practical effect is the chilling of legitimate activity by ordinary citizens, while the determined actors it nominally targets route around it. If that thesis holds, the appropriate policy response is targeted law enforcement using traditional tools rather than infrastructure-level surveillance whose costs fall on the population it is supposed to protect.